TuxBot v3 Evolution: Keksec-Linked IoT/Linux Botnet with Verbatim LLM Chain-of-Thought Code Artifacts

TuxBot v3 Evolution (TL-2026-1397), also tracked as TuxBot v3 Evolution, is a medium-severity malware campaign, first published 2026-07-16. It is attributed to Keksec-affiliated developer with medium confidence, affects Multiple IoT/embedded device vendors 30+ IoT device families with, references 10 CVEs (CVE-2013-7471, CVE-2014-8361, CVE-2017-17215), maps to 17 MITRE ATT&CK techniques (T1027, T1036, T1059), and is covered by 9 detection rules and 29 indicators of compromise.

Key facts for TL-2026-1397

Threat ID
TL-2026-1397
Also known as
TuxBot v3 Evolution, Akiru
Severity
MEDIUM
Status
ACTIVE
Category
MALWARE
First published
2026-07-16
Last reviewed
2026-07-16
Attribution
Keksec-affiliated developer
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
iot-consumer-devices, telecoms, critical-infrastructure-embedded-systems
Target regions
Global
Detection rules
9
Indicators of compromise
29

Malware and tooling in TuxBot v3 Evolution

Malware and tooling: Kaitori v3.9, TuxBot v3 Evolution, aisuru, MHDDoS

TuxBot v3 Evolution is a multi-architecture IoT/Linux botnet framework (bot agent plus Go-based C2 with DDoS-for-hire capability) sharing dropper and C2 infrastructure with Kaitori v3.9 and AISURU, placing its operator inside the Keksec ecosystem. Source files contain raw, unremoved LLM chain-of-thought reasoning and a safety disclaimer the AI appended when asked to generate botnet code, and roughly 70% of its exploit/attack functionality is broken due to implementation bugs (magic-number mismatches, wrong XOR keys, hallucinated crypto).

How TuxBot v3 Evolution works

Palo Alto Networks Unit 42 (Chris Navarrete, Asher Davila, Doel Santos) disclosed TuxBot v3 Evolution, a previously unreported IoT botnet framework consisting of a C-based bot agent that cross-compiles for ARM, ARM64, MIPS, MIPSEL, MIPS64, x86_64, PowerPC, RISC-V, s390x and other architectures (17 total build targets), paired with a Go-based command-and-control server offering DDoS-for-hire functionality over a custom protocol, an interactive SSH admin shell (TCP 2222), and a JSON machine API (TCP 9999). The framework's lineage traces to Mirai, AISURU, and the undisclosed 'Wuhan' botnet family, with DDoS attack code partially ported from the open-source MHDDoS Python toolkit (78 nominal attack vectors mapped to only 6 functional handlers, including Slowloris, Apache Range, and WordPress XMLRPC pingback floods carried over as dead code).

The most novel finding is development tradecraft rather than technical sophistication: multiple C source files retain raw LLM chain-of-thought reasoning left verbatim in comments -- self-interruptions, internal decision narration, and direct references to 'the user' (the developer who prompted the model) -- indicating the bot's exploit VM, crypto layer, and DGA were substantially LLM-generated and shipped without review. Every .c file in the bot directory carries an unremoved AI safety disclaimer header ('for educational and authorized security research only'), and the LLM hallucinated a Argon2id key-derivation implementation that the developer shipped without verifying; at runtime it silently falls back to PBKDF2-SHA256 while still claiming Argon2id in its packet framing.

Operationally, the malware is roughly 70% functional. Its Telnet brute-forcer (1,496 credential pairs sourced from a 'DDOS-ROOTSEC pass_file' set, XOR-obfuscated with key 0xB4), ADB scanner, and SSH/HTTP scanners work as intended and represent the primary functional infection vector. Of 25 embedded IoT-exploit CVE targets, 13 are dead code never invoked, and 12 more are non-functional because the custom exploit-VM compiler emits magic value 0x54555845 ('TUXE') while the VM runtime expects 0x4558504C ('EXPL') -- a build/runtime mismatch that silently breaks every compiled exploit. IRC and HTTP C2 fallback channels are similarly broken due to a string-table XOR key mismatch (entries encrypted with 0x54, decrypted at runtime with 0xB4).

Working C2 channels use X25519 key exchange and ChaCha20-Poly1305 authenticated encryption with a 0xDEADBE01 handshake magic and 0xDEADBEEF packet magic; a SHA-512-based DGA (seed format '%04d-%02d-%02d-TuxBotv3-Evolution-Seed-2025-%d', 20 candidates/day across six TLDs) and a TCP 13337 P2P gossip protocol using Ed25519 signatures provide resilience if the primary C2 (209.182.237.133) is taken down. A dropper server at 185.10.68.127 (Iceland, FlokiNET bulletproof hosting) also serves Kaitori v3.9 binaries at the same path convention, directly linking TuxBot's operator to the Keksec/AISURU DDoS-for-hire ecosystem; passive DNS on that IP surfaces additional DDoS-for-hire domains active since 2021 (vrunabo.su, rezy1337.ted.ge, high.cpu.co.ua). Development artifacts trace a leaked internal hostname (newtuxdev.sevielw.digikalas.online) and a developer-registered domain (digikalas.online, Namecheap, Icelandic WHOIS privacy, hosted on Iranian Arvan Cloud) back to a January 2025 MHDDoS git clone, with production-quality (GCC 14.2.0) samples still being built and benchmarked as of April 2026.

MITRE ATT&CK techniques used in TL-2026-1397

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1568 Dynamic Resolution; T1573 Encrypted Channel

Discovery

T1082 System Information Discovery

Credential Access

T1110 Brute Force

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Impact

T1496 Resource Hijacking; T1498 Network Denial of Service

Persistence

T1543 Create or Modify System Process

Resource Development

T1583 Acquire Infrastructure; T1588 Obtain Capabilities

Reconnaissance

T1595 Active Scanning

Affected products and versions in TuxBot v3 Evolution

  • Multiple IoT/embedded device vendors — 30+ IoT device families with Telnet/SSH/HTTP/ADB management interfaces (targeted by embedded exploit-VM code and 1,496-entry credential brute-force list)
    Vulnerable versions: devices affected by the 10 embedded CVEs listed in cve_list
    Fixed in: vendor firmware releases patching the respective CVEs

Remediation for TuxBot v3 Evolution

Patches

  • Apply vendor firmware updates addressing CVE-2013-7471, CVE-2014-8361, CVE-2017-17215, CVE-2018-10561, CVE-2020-8515, CVE-2022-1388, CVE-2022-22965, CVE-2022-30525, CVE-2022-44877, and CVE-2023-39780 on any affected embedded/IoT/management devices, since these are the vulnerabilities embedded in the bot's exploit-VM code paths

Immediate actions

  • Block outbound/inbound traffic to 209.182.237.133 (primary C2), 185.10.68.127 (dropper), and 188.166.2.226 (Tsunami payload host) at the perimeter
  • Sinkhole or block DNS resolution to digikalas[.]online, jetross[.]com, c2.tuxbot.local, and the passive-DNS-linked domains vrunabo[.]su, rezy1337.ted[.]ge, high.cpu.co[.]ua
  • Force-rotate default/weak Telnet, SSH, and ADB credentials on all IoT/embedded devices; disable Telnet and ADB-over-network where not operationally required
  • Hunt for the persistence indicators sd-pam.service (systemd unit), /tmp/.%08x.lock lock files, and console banner 'Infected By Akiru' on Linux/embedded hosts

Workarounds

  • Disable unused management interfaces (Telnet, ADB-over-TCP, exposed HTTP admin panels) on IoT devices until firmware can be patched
  • Rate-limit or block inbound connection attempts on TCP 1999, 31337, 2222, 9999, and 13337 from untrusted networks where these ports are exposed on management infrastructure

Longer-term hardening

  • Deploy network egress monitoring/IDS signatures for the 0xDEADBEEF C2 packet magic, 0xDEADBE01 handshake magic, and the SHA-512 TuxBotv3-Evolution DGA seed pattern
  • Segment IoT/embedded device networks from general enterprise traffic and enforce default-deny egress for devices with no legitimate need for outbound Internet access
  • Maintain an IoT firmware patch/inventory program covering the CVEs this framework targets, since future TuxBot builds may fix the current exploit-VM magic-number bug and reactivate dormant exploit code
  • Monitor for reuse of the FlokiNET/Iceland and Arvan Cloud/Iran hosting patterns and Namecheap WHOIS-privacy registration style associated with this operator cluster

CVEs associated with TuxBot v3 Evolution

CVE-2013-7471, CVE-2014-8361, CVE-2017-17215, CVE-2018-10561, CVE-2022-30525, CVE-2023-39780, CVE-2020-8515, CVE-2022-1388, CVE-2022-22965, CVE-2022-44877

Weaknesses (CWE) in TuxBot v3 Evolution

CWE-798, CWE-306, CWE-327

Timeline of TuxBot v3 Evolution

  • Developer clones the open-source MHDDoS Python DDoS toolkit from GitHub; internal hostname newtuxdev.sevielw.digikalas.online later leaks this connection.
  • Domain digikalas[.]online registered via Namecheap with Icelandic WHOIS privacy protection, later hosted on Iranian Arvan Cloud.
  • 254 automated DDoS benchmark reports generated over a three-day window (Jan 4-6, 2026), indicating active development/testing of attack modules.
  • First TuxBot sample (debug build) submitted to VirusTotal, hash 71dfbb171eca4ef9d02ff630b56e5283bbef7b375d4dbe9e8c9531bef312fa8d.
  • TuxBot C2 server first observed on Palo Alto Networks Xpanse.
  • Six new production-quality samples detected, compiled with GCC 14.2.0, indicating continued active development.
  • Palo Alto Networks Unit 42 (Chris Navarrete, Asher Davila, Doel Santos) publicly discloses TuxBot v3 Evolution, including the LLM chain-of-thought artifacts and Keksec/Kaitori/AISURU infrastructure links; covered same-day by The Hacker News.
  • TL-Intel Harness opens TL-2026-1397 to track TuxBot v3 Evolution and its Keksec ecosystem linkage.

Sources cited for TuxBot v3 Evolution

Threats related to TuxBot v3 Evolution

Detection coverage for TL-2026-1397

As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1397 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats